Take the 2-minute tour ×
Drupal Answers is a question and answer site for Drupal developers and administrators. It's 100% free, no registration required.

I want to disable the PHP Filter module on a large website, but going through all nodes, blocks and other fields where you could make possible use of the php filter would take eons.

Is there a simple way or method maybe by running SQL queries to find out where the php filter is used throughout my website?

share|improve this question

2 Answers 2

up vote 5 down vote accepted

Rather than re-inventing the wheel, just install the Security Review module, which has the following check:

PHP or Javascript in content (nodes and comments and fields in Drupal 7)

For blocks you can check the format column in the block_custom table.

The difficult one is Views - I've yet to find a reliable way to locate rogue PHP in Views programmatically.

share|improve this answer
1  
I guess if Security Review guys wasn't able to add a reliable check for Views, it may be simply next thing to impossible. –  Mołot Apr 18 at 11:03
    
@Mołot thanks, hadn't seen that issue –  Clive Apr 18 at 11:16
    
@Mołot : Just found a way to retrieve views which has php enabled please see my answer below.. It will be great to know it has any downsides or edge cases... –  Anil Sagar Apr 18 at 12:02
    
All I got is "OK Untrusted users do not have access to use the PHP input format." - with latest version. It got me green when I had a block with php input format on front page. Your answer seems to be simply untrue at the moment. –  Mołot Dec 2 at 23:30

You can able to find all views which have php enabled by running below command in MySQL...

SELECT vv.name , vd.display_options
FROM views_display AS vd
LEFT JOIN views_view AS vv ON vv.vid = vd.vid
WHERE vd.display_options REGEXP '.s:[3]+:"php".*'

views_display table stores this information in serialized format.... I have tested above query works as expected.. Hope it helps to solve the views PHP riddle :-)

share|improve this answer
1  
Looks good. Would need to test it a bit. In the meantime I took liberty of editing and cleaned up the way you wrote the query (without touching it's logic, names etc of course). –  Mołot Apr 18 at 12:05
    
Thank you :-) I just verified and i can able to see views which has php enabled.. Let's hope it works for OP too.. –  Anil Sagar Apr 18 at 12:08
1  
This doesn't work for all views (e.g. those defined in code), and that regex could easily produce false positives...better than nothing though I guess :) –  Clive Apr 18 at 12:14

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.